JDK-8213806 : WebView - JVM crashes for given HTML
  • Type: Bug
  • Component: javafx
  • Sub-Component: web
  • Affected Version: 8u151,10,openjfx11
  • Priority: P2
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: x86_64
  • Submitted: 2018-11-12
  • Updated: 2020-01-31
  • Resolved: 2019-01-24
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 Other
8u211Fixed openjfx11.0.3Fixed
Description
ADDITIONAL SYSTEM INFORMATION :
Its crashes on Win7 64bit, and Linux 64bit (manjaro).
Tested on Jdk 10.0.2 and 11.0.1

A DESCRIPTION OF THE PROBLEM :
JVM crashes wen we load 2 times following HTML to JavaFX WebView component:


<blockquote class=\"twitter-tweet\"><a href=\"https://twitter.com/stu_bot3000/status/793389598227529728?ref_src=twsrc%5Etfw\"></a></blockquote>\n" +
                    "<script src=\"https://platform.twitter.com/widgets.js\"></script>


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Load given HTML to WebView, wait for a while to load content completely, and set this html content again.


---------- BEGIN SOURCE ----------
import javafx.application.Application;
import javafx.application.Platform;
import javafx.scene.Scene;
import javafx.scene.web.WebView;
import javafx.stage.Stage;

public class Main extends Application {

    public static void main(String[] args) {
        Application.launch(args);
    }

    @Override
    public void start(Stage primaryStage) {
        try {
            WebView webView = new WebView();

            Scene scene = new Scene(webView, 800, 600);
            primaryStage.setScene(scene);
            primaryStage.show();

            String crashHtml = "<blockquote class=\"twitter-tweet\"><a href=\"https://twitter.com/stu_bot3000/status/793389598227529728?ref_src=twsrc%5Etfw\"></a></blockquote>\n" +
                    "<script src=\"https://platform.twitter.com/widgets.js\"></script>";

            webView.getEngine().loadContent(crashHtml);

            new Thread(() -> {
                try {
                    System.out.println("Wait 5 sec to full load, then set this content again...");
                    Thread.sleep(5000);
                    Platform.runLater(() -> {
                        System.out.println("Reloading... and crash...");
                        webView.getEngine().loadContent(crashHtml);
                    });
                } catch (Exception e) {
                }
            }).start();


        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}
---------- END SOURCE ----------

FREQUENCY : always



Comments
Changeset: 20234c4d09b8 Author: arajkumar Date: 2019-01-24 14:15 +0530 URL: http://hg.openjdk.java.net/openjfx/jfx-dev/rt/rev/20234c4d09b8 8213806: WebView - JVM crashes for given HTML Reviewed-by: mbilla, kcr
24-01-2019

[~kcr], [~mbilla], Please review the following PR https://github.com/javafxports/openjdk-jfx/pull/355
22-01-2019

[Debugging..In progress] load method calls Java_com_sun_webkit_WebPage_twkOpen() which calls frame->loader().load() with corresponding URL. loadContent method calls Java_com_sun_webkit_WebPage_twkLoad(), which creates SharedBuffer for corresponding content and calls frame->loader().load(). The difference for Java_com_sun_webkit_WebPage_twkLoad() between 604.1 and 607.1 is changing from "buffer" to "WTFMove(buffer)" as SubstituteData now accepts rvalue reference and this should not cause the crash.
02-01-2019

Yes, using 'load(load.html)' works fine. It loads the html initially and reloads the same after 5 secs.
10-12-2018

I changed Main2.java from loadContent to load(load.html) and i don't see the crash. I can see reload after 5 secs as well.
05-12-2018

Raising to P2, since this is a repeatable crash (not to mention a regression).
19-11-2018

tested with jfx-dev on mac: Note: The crash occurs even if we load the html content only once: C [libjfxwebkit.dylib+0x1091a9f] WTF::KeyValuePair<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> > >* WTF::HashTable<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::KeyValuePair<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> > > >, WTF::PairHash<WTF::String, WebCore::CSSParserContext>, WTF::HashMap<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> >, WTF::PairHash<WTF::String, WebCore::CSSParserContext>, WTF::HashTraits<std::__1::pair<WTF::String, WebCore::CSSParserContext> >, WTF::HashTraits<WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> > > >::KeyValuePairTraits, WTF::HashTraits<std::__1::pair<WTF::String, WebCore::CSSParserContext> > >::lookup<WTF::HashMapTranslatorAdapter<WTF::HashMap<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> >, WTF::PairHash<WTF::String, WebCore::CSSParserContext>, WTF::HashTraits<std::__1::pair<WTF::String, WebCore::CSSParserContext> >, WTF::HashTraits<WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> > > >::KeyValuePairTraits, WTF::IdentityHashTranslator<WTF::HashMap<std::__1::pair<WTF::String, WebCore::CSSParserContext>, WTF::RefPtr<WebCore::StyleSheetContents, WTF::DumbPtrTraits<WebCore::StyleSheetContents> >, WTF::PairHash<WTF::String, WebCore::CSSParserContext>, WTF::HashTraits<std::__1::pair<WTF::String, WebCore::CSSParserContext> >, WTF::HashTraits<WTF::RefPtr<WebCore::StyleSheetContents, WTF C [libjfxwebkit.dylib+0x108f313] WebCore::InlineStyleSheetOwner::createSheet(WebCore::Element&, WTF::String const&)+0x373 C [libjfxwebkit.dylib+0x108ed8c] WebCore::InlineStyleSheetOwner::insertedIntoDocument(WebCore::Element&)+0x4c C [libjfxwebkit.dylib+0x12382b8] WebCore::HTMLStyleElement::insertedIntoAncestor(WebCore::Node::InsertionType, WebCore::ContainerNode&)+0x28 C [libjfxwebkit.dylib+0x102cf0d] WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WebCore::TreeScopeChange, WTF::Vector<WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&)+0x3d C [libjfxwebkit.dylib+0x102cf88] WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WebCore::TreeScopeChange, WTF::Vector<WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&)+0xb8 C [libjfxwebkit.dylib+0x102d004] WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WebCore::TreeScopeChange, WTF::Vector<WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&)+0x134 C [libjfxwebkit.dylib+0x102ce23] WebCore::notifyChildNodeInserted(WebCore::ContainerNode&, WebCore::Node&)+0x73 C [libjfxwebkit.dylib+0x1027b3a] WebCore::ContainerNode::insertBefore(WebCore::Node&, WebCore::Node*)+0x2fa C [libjfxwebkit.dylib+0x10a1deb] WebCore::Node::insertBefore(WebCore::Node&, WebCore::Node*)+0x2b C [libjfxwebkit.dylib+0xc386bf] WebCore::jsNodePrototypeFunctionInsertBefore(JSC::ExecState*)+0x19f
19-11-2018

Issue is reproducible and regression introduced in JDK 8u151-b06. Windows 10, 64-bit JDK results -------------------------------- 8u151-b05 : Pass 8u151-b06 : Fail <-- regression 8u192-b12 : Fail 10.0.2 : Fail Openjfx 11.0.1 : Fail -------------------------------- Also note that with JDK 8u151-b06, jvm crashes with first load of html content itself, while with JDK 10.0.2 it neither crashes nor loads the content with first loadContent().
13-11-2018